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REMARKS 

Favorable reconsideration of this application, in view of the present amendments and 
in light of the following discussion, is respectfully requested. 

Claims 15-28 are pending. Claims 15-16, 21-22 and 25-26 are amended to further 
clarify the features contained therein. No new matter is introduced. 

In the outstanding Office Action, Claims 15-28 were rejected under 35 U.S.C. 
§ 103(a) as being unpatentable over Talpade (U.S. Patent Application Publication No. 
2004/0148520) in view of Sharp (U.S. Patent Application Publication No. 2003/01 10394) 
and Sonnenberg (U.S. Patent No. 7,076,650). 

In reply, Claim 15 is amended to recite, inter alia, a system of protecting a 

communication device against a denial-of-service attack that includes, 

a monitoring device provided on a local area network including the 
communication device, the monitoring device being configured to monitor 
a packet transmitted to the communication device via an internet-service- 
provider network; and 

wherein the monitoring device includes 

an attack detecting unit configured to detect an attack by the packet 
on the communication device based on an attack detection condition 
including a destination address and a port number of the 
packet. . .(Emphasis added.) 

Turning to the primary reference, Talpade generally describes a system for detecting 
and mitigating service attacks using a sensor, an analysis engine, and at least one filter 
router. 1 As noted in previous responses, Talpade describes that the sensor (234) transmits an 
indication of attack on customer networks (204, 206) to the analysis engine (232), which, in 
turn, configures the filter router (230) to reroute packets from each border and edge router 
(220, 222, 224, and 228) to the filter router (230) for filtration. 2 The analysis engine (232) 
determines whether a packet is part of a service attack by identifying a signature of a known 

1 Talpade at paragraphs 8-9. 

2 Id. 
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service attack tool, determining the validity of various packet header fields and/or performing 
volume-based detection. 3 Talpade also describes that packet source EP addresses may be used 
to determine whether packets from a particular source enter the ISP network (202) through an 
expected ingress port. 4 

However, Talpade does not describe that the analysis engine (232) uses a destination 
address and a port number of the packet to determine whether the packet is part of a service 
attack. As discussed above, Talpade only describes using the source IP address of the packet, 
and attack tool signature, or the validity of header values in order to identify packets that 
form part of a service attack. 5 Conversely, amended Claim 1 recites that the monitoring 
device includes an attack detecting unit configured to detect an attack by the packet on the 
communication device based on an attack detection condition including a destination 
address and a port number of the packet. Therefore, Talpade fails to disclose or suggest the 
claimed attack detecting unit recited in amended Claim 15. 

Moreover, Sharp describes a system and associated methodology used to detect and 
prevent spoofing of a source IP address. 6 Specifically, Sharp describes using a MAC address 
of an ethernet card, a query of domain name server cables or embedding ID numbers in 
packets to determine whether they are received from a valid source. 7 Moreover, Sharp also 
describes determining whether a packet is part of an attack based on the volume of packets 
received from a certain IP address. 8 Nowhere, however, does Sharp describe using the 
destination IP address and a port number of packets to filter packets as being part of a service 
attack or removed packets from filtering that are not part of the service attack. Further, 
Sonnenberg does not cure the above deficiencies in Talpade and Sharp . Accordingly, no 

3 Talpade at paragraph 20. 

4 Talpade at paragraph 34. 

5 Talpade at paragraph 20. 

6 Sharp at paragraph 10. 

7 Sharp at paragraphs 10-12. 

8 Sharp at paragraphs 47-50. 
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combination of Talpade . Sharp and Sonnenberg describes every feature recited in amended 
Claim 15, and amended Claim 15 is believed to be in condition for allowance together with 
any claim depending therefrom. 

Moreover, amended Claims 21 and 25 recite features substantially similar to those 
recited in amended Claim 15 and are therefore believed to be in condition for allowance, 
together with any claim depending therefrom, for substantially similar reasons. Accordingly, 
it is respectfully requested that the rejection of Claims 15-28 under 35 U.S.C. § 103(a) be 
withdrawn. 

For the reasons discussed above, no further issues are believed to be outstanding in 
the present application, and the present application is believed to be in condition for formal 
allowance. Therefore, a Notice of Allowance for Claims 15-28 is earnestly solicited. 
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